c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739

Analysis

max time kernel
10s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe
Size 178KB
Sample240613-cdwzkatfpj
SHA256 c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739
MD5 b631c18db90712b27ef786be87a7ea58
SHA1 605f0778534950816d2fd6bb7a625b858aa9948d
SHA512 ac35b6d119ba32aca21ffb50586380ca5ddc73877c35b1b0e2507031c4d48e6d414302062cfebca53a45718105e0567f89c6d0123049fb8eb5dd006c15bd6587
SSDEEP 3072:H+MjfRiAabwOBTgGxU8OSY4TX/z5A65N1AJJn5Jt+BEN22vrn7MyMMQr28C43wI6:H+MjRiAabfBTnS8OD4TX/z5rj1Abn5JD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bootkit discovery evasion exploit persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1732	takeown.exe
1072	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1072	icacls.exe
1732	takeown.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1732	takeown.exe
Token: SeShutdownPrivilege	2808	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3216	2808	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe	83
PID 2808 wrote to memory of 3216	2808	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe	83
PID 2808 wrote to memory of 3216	2808	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe	83
PID 3216 wrote to memory of 1732	3216	cmd.exe	84
PID 3216 wrote to memory of 1732	3216	cmd.exe	84
PID 3216 wrote to memory of 1732	3216	cmd.exe	84
PID 2808 wrote to memory of 228	2808	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe	85
PID 2808 wrote to memory of 228	2808	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe	85
PID 2808 wrote to memory of 228	2808	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe	85
PID 228 wrote to memory of 1072	228	cmd.exe	86
PID 228 wrote to memory of 1072	228	cmd.exe	86
PID 228 wrote to memory of 1072	228	cmd.exe	86

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe

C:\Users\Admin\AppData\Local\Temp\c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe
"C:\Users\Admin\AppData\Local\Temp\c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\consent.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\consent.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\consent.exe /deny SYSTEM:F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\consent.exe /deny SYSTEM:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1072